Microsoft Denies Windows 8 App Spying Via SmartScreen 198
An anonymous reader writes "Microsoft has denied Windows 8 SmartScreen is spying after research by Nadim Kobeissi indicated otherwise." Whether it's "spying" or not, Microsoft is collecting certain information with SmartScreen — the key is what's done with it: The article quotes a Microsoft spokesperson: "We don’t use this data to identify, contact or target advertising to our users and we don’t share it with third parties."
Disable it! (Score:5, Informative)
Re: (Score:3, Informative)
There is a check box where you can disable this 'feature' before installation. Nothing to see here....
Why is the parent moded -1?
Re: (Score:2, Insightful)
Maybe because he completely misses the point.
Re:Disable it! (Score:5, Interesting)
Just read the Ars Technica article. [arstechnica.com] The Slashdot headline is ridiculously slanted, as was the previous story.
While I disagree with it in principle - I'd rather it be local, like how Firefox uses a local version of the bad-sites list, this is not in any way unusual or awful behavior, and it's mostly a good idea, and Microsoft has been completely open about how and why they're doing this and giving you an easy way to turn it off. It is not some privacy invading nightmare. Microsoft is not keeping track of what programs you download (unless, obviously, you get them through the Microsoft store.)
Slashdot stories are becoming more and more ridiculous. The summaries are never even worth reading anymore.
Re: (Score:2)
The summaries are never even worth reading anymore.
No one reads TFA any more, you're just now coming around to the idea of not reading the summaries, while many of us have been just reading the headlines for quite some time...
Re: (Score:2)
The summaries are never even worth reading anymore.
No one reads TFA any more, you're just now coming around to the idea of not reading the summaries, while many of us have been just reading the headlines for quite some time...
I've been doing it that way for at least 10 years. Now be a good boy sonny and fetch my pills for me, I can't seem to find them...
Re:Disable it! (Score:5, Interesting)
There are a whole load of "suddenly technically knowlagable" people dissembling here (I'd hate to say shills; but somewhere someone is feeding in disinformation).
Now let's have a look at some of the language being used in the Ars Technica article.
"some estimates" implies that there wold be uncertainty; that Microsoft wouldn't be able to say 100% that you were using a piece of software. Maybe it is Tor; maybe it's actually Tornado the game. The implication is a humal level of uncertainty which just doesn't apply.
"which IP addresses" implies that Microsoft would not know who you are. This shows an even greater level of deception. It's even trying to imply that your information may not be linked, if, for example, you change IP addresses. Microsoft has your software registration. Microsoft knows about your usage of Bing. Microsoft has your passport account. If any company other than Google can link your IP address to a particular person; that company is Microsoft.
Compared to this Ars Technica article, Slashdot is a haven of technical superiority and higher journalistic ethics and integrity. Maybe Anonymous Coward could set up a journalism course for the guys at Ars Technica.
Finally let's look at Microsoft's statement in the article (N.B. we don't get told what question this is an answer to; note that it might potentially be Microsoft answering to a question about their web sites in which case Ars Technica is again doing the deception; let's take it at face value however).
The entire point of this service is to build up a "historical" database of executables. It works by identifying those downloads which are known and safe by how often they are downloaded and builds up a "reputation". Ars Technica describes this as "anonymised" without going into details. If you think that they don't at least have the IP network address then I have a bridge to sell you. Let me explain a simple exploit for you: before releasing your malware, repeatedly download it on each of your computers Microsoft will sign it as as having a good reputation. Microsoft's only possible defence against this is to ensure that it knows, at least to some level, which IP addresses used which software.
Re: (Score:2)
What? Can you cite a source that says it works via reputation and not by a simple black list?
Re: (Score:2)
Re: (Score:2)
Thanks. I had not seen that. I have actually seen that notification in IE9 before, actually.
Re: (Score:3)
Yet no one cares that Firefox and Google do exactly the same thing, plus that they do it with a unique key for every Firefox install. That key allows Google to identify a firefox session, even when it's "In Private"
If you block the connection to Google's Safe Browsing service at either the firewall or proxy server, then the firefox installs silently fail. You Must disable the check in about:config (safe) to do so and there are six entries and every one has to be reset to off otherwise safe browsing is not
Re: (Score:3)
Interesting....do you by chance have any links to instructions on how to disable all of this in FF?
Re:Disable it! (Score:4, Informative)
Nope. I'd rather have a local database, even though I assume that's more difficult to keep up-to-date with what I imagine are rapidly changing blacklists. Firefox, for example does this.
But this behavior is (unfortunately) pretty bog standard, and in the case of IE, it's nothing new, so it seems a little bizarre to get all outraged about it now when all Microsoft has added is a check on file download hashes.
They said "don't", but not "won't" (Score:2, Insightful)
From TFS and TFA:
The article quotes a Microsoft spokesperson as saying: "We don’t use this data to identify, contact or target advertising to our users and we don’t share it with third parties."
Now, if they had said "don't and won't", then that would mean something. Just saying "don't" means they don't do it today with no guarantee about what they might do with all that data at some future date. Color me unimpressed.
A quibbler might also note that the spokesperson only mentioned the data itself, not results extracted from it. Color me unimpressed yet again.
Re:Disable it! (Score:5, Informative)
Look in his history: His Karma is negative. The comment hasn't even been modded.
Re: (Score:2, Insightful)
That happens here when you legitimately defend Microsoft.
Re: (Score:3)
"Look in his history: His Karma is negative. The comment hasn't even been modded."
Don't believe the history of zenlessyank, or anyone else. At least in my case, every comment score is wrong, on the low side. How's yours? The history function should be fixed or removed- it's been broken far too long.
OTOH, zenlessyank is remarkably fond of exclamations--used in most titles. Those exclamations tend to be rants, many with a religious undercurrent. Zenlessyank is not given to subtlety which may have something to
Re: (Score:2)
Mine is pretty accurate, considering I have a +2 Karma bonus, so I don't need many pluses to get a 5, and usually get 15 mod points at a time, with a rare 5 from time to time.
zenlessyank's history is not informative based on the scores, because negative karma grants you anywhere from +2 to -1 automatically. It doesn't matter what a post score is. Just read the comments. I find history invaluable when moderating, because it can help when I can't determine when someone is sarcastic or genuinely idiotic.
A f
Re: (Score:2)
"Comment: Re:Disable it! (Score 1)
by b4dc0d3r on 12-08-25 21:14 (#41127109) Attached to: Microsoft Denies Windows 8 App Spying Via SmartScreen
Mine is pretty accurate..."
Actually, it's not... Your History (excerpt above) says that comment is a Score 1, while the comment in the context of TFA says you earned a Score 2.
Likewise, my comment in History: "Re:Recourse (Score 4, Interesting)" actually earned a Score 5. As I mentioned, almost all my History is wrong, in a negative way.
I've checked my history several
Re: (Score:2)
Why is the parent moded -1?
Likely because the jackass population on /. is too high and they enjoy modding people down for no damned good reason.
Personally I don't care if this feature is used to spy or not. I won't buy or use Windows 8 if I can possibly avoid it. I'd dump everything and finally switch to some flavor of Linux first.
Re:Disable it! (Score:4, Insightful)
There is a check box where you can disable this 'feature' before installation.
Nothing to see here....
Because at least 1% of Windows users are capable of installing the OS themselves.
Re: (Score:3)
Re: (Score:3)
And if you get it pre-installed there is a checkbox in Action center that kills it, which if you are so clueless that you can't even uncheck a checkbox in a GUI? Really having a hard time feeling sorry for you.
Normally I would agree with you, but having done a whole lot of Windows support over the years? There are way too many people out there (I daresay a majority among the consumers) who doesn't even know what an Action Center is, or what the smartscreen feature really does, let alone know to go there and uncheck the box. To top it off, odds are good (disclosure, I haven't looked) that disabling the feature will come with a pop-up window warning dire consequences if the user goes through with opting-out. (simil
Re: (Score:2)
Re: (Score:2)
Re:Disable it! (Score:4, Informative)
Re:Disable it! (Score:4, Interesting)
The check box appears on first account setup, so any use buying a new PC will see it too.
The choice should be Opt-in, rather than Opt-out. This is just like their old "everything is enabled" features. It's not hard to have a screen pop up asking you if you want this info reported to Microsoft. Then you say "Yes or no. Then if you are okay, click on that yes, if not, nothing happens.
Re: (Score:2)
I prefer all security settings default to enabled and I turn off what I don't need. Especially considering the wider Windows audience.
Re: (Score:2)
Yes, it appears as a check-box (or equivalent), labeled "SmartScreen".
Who do you think knows what that means? Especially when you are setting up your computer and can't just search for what it means because the desktop is not yet available?
It sounds safe and secure, so you statistically will leave it allowed. Will you write it down for further research on whether to leave it checked, and if not how to un-check it? Statistically, no.
Users will see it, but not understand it.
Since I have already posted here
Re: (Score:2)
Yes, it appears as a check-box (or equivalent), labeled "SmartScreen".
No, it does not. The exact text next to the checkbox is: "Use Windows Smartscreen Filter to Check Files and Apps with Microsoft." This is a very brief yet clear description of what the feature is and that you will indeed be checking in with Microsoft with respect to files and apps.
Especially when you are setting up your computer and can't just search for what it means because the desktop is not yet available?
Clearly you don't know what you're talking about. Have you ever actually installed Windows 8? There are two links right there in the overview screen for Express Settings. One goes into detail what each setting is for and what it d
Re:Disable it! (Score:5, Funny)
The elevator has a "close door" button inside. Do you believe it actually functions?
Re: (Score:3)
Re: (Score:2)
Again, on many systems it does function, as you readily agree. (though you contradict yourself in your post as well)
Re: (Score:2)
Re: (Score:3)
It does work in my workplace. I guess it depends on whether you trust your users to use the button properly. My workplace does, my apartment does not.
Re: (Score:2)
Re: (Score:3)
Around here the crosswalk buttons are at least hooked up and responsive. I will get a walk signal if and only if I press the button, otherwise the traffic lights change but the don't walk signal stays lit. I do still doubt that they affect the timing of the lights, but they are connected to something.
Re:Disable it! (Score:5, Insightful)
Re:Disable it! (Score:5, Informative)
Here is a link to my comment from yesterday, which has the exact text relevant to smart screen you encounter on install: http://slashdot.org/comments.pl?sid=3070309&cid=41111521 [slashdot.org]
Re: (Score:2)
Tin Horns & Tin Opinions (Score:2)
Re: (Score:2)
There is a check box where you can disable this 'feature' before installation. Nothing to see here....
Critical Update required, for national security.
Re: (Score:2)
How about after installation? :P
Re: (Score:2)
Re: (Score:2)
This, unfortunately, is where the disadvantage of closed-source strikes: you cannot really verify that a device serves you instead of someone else. As soon as you install a binary, or a patch, you hand over control of your device to whoever wrote the code. We all know that. You basically need to trust the one pushing the patches to you.
Now that's not the en
Re:Disable it! (Score:5, Informative)
Re: (Score:2, Insightful)
How hard would it be to do it locally (like every other anti-malware/antivirus tool does)? If so why choose to do it remotely?
Re: (Score:2)
I'd rather it be done locally as well. I suppose the reason it's done remotely is so the blacklist can be updated and maintained on the server side. That's a perfectly good reason - Chrome sends all your URLs to check against a server-side blacklist as well - and it is probably better from the security standpoint.
Long-term, though, I think the remote check opens up a potential for vector for invading privacy in the future, which I'd rather not have.
Comment removed (Score:4, Informative)
Re: (Score:3)
Because then the malware will simply target this just like they do other Windows components?
What makes you think service cannot be targeted just because the list of hashes is stored remotely? The service still has create the hash locally and query the remote hash list. This service would be as effective if the hash list is local.
Re: (Score:2)
Re: (Score:3)
If a hacker can modify its files, he can easily make it to not submit the hash at all (or always submit a different hash for a specific set of hashes). Unless you have hardware support (like trusted computing device), you have no way of verifying your own program has been modified. If the hacker cannot change any of your files, he cannot change your local hash list file either. So I dont see the benefit of having the hashes remotely.
My question still is why do they opt to do this. If I submit a comp
Re: (Score:2)
Well that, and you entered into an arrangement with MS when you chose to install their operating system, whatever you may think of that arrangement, microsoft kinda needs to know what you're doing on the computer to know what's causing problems, because lets face it there are a lot of copies of windows in the world an even rare errors can cause huge chaos.
That doesn't mean you can't (or shouldn't) opt out of anything you're not comfortable with, but if you want stuff to work microsoft needs to know what's b
Re: (Score:2)
You'd have to be a drooling moron to go without a tinfoil hat these days. The Ars article reeks of weasel words.
Re: (Score:2)
Is this your entry to the English grammar obfuscation contest? Wow, my head hurts.
Re: (Score:3)
Should Linux repositories, the Apple App Store, the Google Store, and the Microsoft store provide a similar warning, since they actually glean more information from what you download there?
I mean, all Microsoft gets from this is a filename and a hash. Unless Microsoft has a hash of every program in existence, that doesn't do them much good for spying purposes. On the other hand, they know everything about the app you're downloading from their store.
Re: (Score:2)
When I download a binary from another location or build from source Linux distributions don't report that to a corporation. If Microsoft had a repository then that would be different. They don't. You would have to be a moron not to know that, in those other scenarios, they know your IP and what you are installing.
Re: (Score:2)
So much users are too dumb to understand the simple description of SmartScreen, but bright enough to think through the implications of downloading apps through the Microsoft Store?
Re: (Score:3)
Re: (Score:2)
What difference does that make from a privacy perspective? How do I legitimately install apps on my (imaginary) iPhone outside of Apple's install channel?
Again, Microsoft is not reporting what you install. It is sending a filename and hash of executables you download via IE to Microsoft to compare against a blacklist.
This is on top of the regular SmartScreen filter, which reports URLs to Microsoft to compare against a blacklist and which has been pretty uncontroversial for years, same as Chrome. (I still di
Re: (Score:2)
OK. Care to show me what about that statement is untrue?
Re: (Score:2)
Re: (Score:2)
A hash doesn't identify an executable unless you have a list of the hashes of every executable rather than just a blacklist of malware hashes.
And again, this applies only to files downloaded with IE.
And again, the logs are wiped on a regular basis.
Even ignoring all this, you've yet to explain why it is the common man understands perfectly the ramifications of downloaded from an app store, but not that of SmartScreen. Especially when SmartScreen's potential problems are explained.
Re: (Score:2)
When the system sends a notification to Redhat that you have installed something that you did not grab fr
Re: (Score:3)
Microsoft doesn't "scan your computers for apps." They compare the filename and hash of executables downloaded with Internet Explorer with a known blacklist.
Sounds lke the same thing as Google (Score:2, Insightful)
Re: (Score:2)
Yep.. when you get a new 'droid, iPhone or iPad, all of your apps automatically reinstall...wonder how that happens. Just because it's Microsoft this is an issue. Actually SmartScreen on Windows 8 is a good way to see what my kid is doing on the Internet without some 3rd party crapware that is definitely using your shit in ways you don't know about. And as other posters have said you can just turn it off.
Re:Sounds lke the same thing as Google (Score:4, Informative)
"Yep.. when you get a new 'droid....automatically reinstall...wonder how that happens."
Not much to wonder about, on Android you have to opt-in to this service.
Settings -> Privacy:
Back up my data [ ]
Re: (Score:3)
Do you opt-in to Chrome sending your URLs to Google?
Because that would be the equivalent analogy. SmartScreen sends URLs and file hashes to Microsoft, the exact same way Google's anti-malware sends URLs to Google to compare against a blacklist.
And besides, that, Google "collects" information about what you download through their store, in the same sense - you can't download the app without them knowing your IP, which is the same information Microsoft is getting. If you really cared about this kind of privac
Re: (Score:3)
-you opt to install/use chrome, it doesn't come standard. I presume people read the EULA if they install software! Same goes for Firefox BTW.
-Google collects info on what you download from the Google store. Flip the checkbox to install from other sources, Google doesn't get that info. So not exactly the same as all downloads are send to OS manufacturer.
Re: (Score:2)
Flip the checkbox to turn SmartScreen off then.
It's equally as simple. Probably simpler - never used an Android phone. Both are opt-out from your description, and the SmartScreen functionality seems to be outright presented as an option on installation.
I am also pretty sure that Chrome does, in fact, come standard on Chrome OS and I assume that the default web browser on Androids is Chrome or some variant thereof that sends your URLs to Google same as Chrome does.
Re: (Score:2)
I think it's more like the Play Store knows what you have/had installed and will automatically re-install this. After all they do keep track of what you have installed. Backing up data is, afaik, just data: your own data. Not the apps themselves.
No direct experience with that reinstall part myself, still on my first Android.
Re: (Score:2)
It actually asks you about that when you activate the new device and specify your Google ID during initial setup. And if I remember correctly, the default was "yes".
Win8 similarly asks when you run it for the first time, while setting up the user account (and the default is also "yes").
use of information doesn't matter (Score:4, Insightful)
Collecting the information IS spying.
How the information is used after being collected does not matter for determining spying, only the motivation for spying.
Spying (Score:2)
Let's use Microsoft's language to see if we can justify other instances of spying:
"We donâ(TM)t use this hole in the girl's lockerroom wall to identify, contact or target advertising to our users and we donâ(TM)t share it with third parties."
Does that work? No? Then why should it work here?
Re: (Score:2)
I thought SmartScreen just sends the name and hash of the download file. You didn't list that as spying, and while you did list "digging through your install logs" that's not the same thing.
Could use it in the future (Score:2)
Note that they only say they don't do these things *now*. They don't say they won't in the future.
Re:Could use it in the future (Score:4, Insightful)
Sensationalism (Score:5, Insightful)
Re:Sensationalism (Score:5, Insightful)
I see /. is in for another round of anti-Windows 8 sensationalism. Please read the Ars Technica article [arstechnica.com] talking about this before commentating.
Ah, sweet irony. Your Ars Technica article links to a wired article that argues cryptocat is no more secure than using no crypto at all, because it relies on host security, and then proceeds to defend Smart Screen using a host-security argument.
If you don't care Microsoft gets access to which programs you run / trust that they will keep the data anonymized and periodically delete the logs as you claim, by all means, don't turn off Smart Screen. That said, they have all the data they need to keep a record if every program you run, and I'd rather not take them at their word that they won't do anything bad with it.
Re: (Score:2)
In other news Apple collects information for every app users install on their iPhones. So will MS on WinRT tablets and Win 8 Metro environment. In a world like this only an idiot can point a finger in a security service that uses hashes and can be turned off.
Re: (Score:2)
More like "Billy, don't hit people with a stick. I don't mind if you hit them with baseball bat"
Re: (Score:2)
I was wondering how long it would take before somebody brought up Cryptocat, and whether the person doing so would have a clue or not. Looks like the answers are "not long" and "no".
The goal of SmartScreen is to warn the user against running malicious software. The goal of Cryptocat is to make a user's chat session completely untappable. Not only are these two goals quite different, but most of the weaknesses of Cryptocat are based on an environment that SmartScreen simply doesn't have. Also, it's not "no m
Re: (Score:2)
Cryptocat has two major weaknesses against its current implementation
I wasn't arguing for the security of cryptocat. I hadn't even heard of it before I saw the article. I was merely commenting on the irony that the same (in my opinion, very valid arguments) against cryptocat in the wired article linked in the Ars Technica article would also apply to Smart Screen.
Also, it's not "no more secure than using no crypto at all"
Right, I doubt that would be the case too, but from the article I'm talking about, "More generally, your security in a host-based encryption system is no better than having no crypto at all."
Basically, that article
Re: (Score:2)
I see /. is in for another round of anti-Windows 8 sensationalism.
Yep, reminds me of all the Visa BS. Win will they learn, eh? Just because MS sometimes makes a shit OS every once in a while, doesn't mean any of the others are any more acceptable.
Um.. They didn't exactly deny it. (Score:3)
Re: (Score:2)
Re: (Score:2)
So what? If the feds want to know what you're downloading and such, it's a hell of a lot easier to go through your ISP. Smartscreen as a sniffing vector is technically true but completely irrelevant to the difficulty of the attack you propose.
Re: (Score:2)
A more reasonable story (Score:4, Informative)
Re: (Score:2)
That screen is telling you that Microsoft is protecting your privacy. Perhaps sending the IP of every site you visit and every file you download is protecting your privacy? Doubleplusgood!
Oh, wait. You send the "Do not Track" button. With all due respect, I suspect that once you hit the do not track button, your IP addresses, history and downloads will be considered much more interesting to people who might find them interesting because you asked them not to track you.
However (Score:3, Informative)
Apple knows not only what applications you have, when you use them, how many times you use them, but where you are down to a resolution of 10m anywhere on the planet you are, at anytime.
doesnt matter if you are a politician, gangster or regular joe
and you are worried about Microsoft ? lol
bottom line is:
do you trust an "American" multi national company with your personal data ?
Is it possible to downmod an entire submission? (Score:3, Interesting)
Because this particular story needs to be marked "-1, Flamebait".
Question? (Score:2)
Is there a way to turn it off after installation? I will also mention the fact that a bunch of bundled software can be gotten rid of after you turn on your brand new laptop/PC.
Re: (Score:3)
Yes. It can be turned off at install, at first boot (for pre-loaded images), or at any time while logged in. There are even instructions from Microsoft for doing so!
Re: (Score:2)
Well then why is there an argument about a question? (i know it's not you).
No spying???? (Score:2)
Of course Microsoft is spying. (Score:2)
Of course Microsoft is spying. They have admitted that they are receiving the data they were accused of receiving. At best they're saying that they won't use the data for advertising purposes.
If they wanted to do this without spying, they could load the signatures of the top 10,000 known-good executables into a file sent out with Windows Update. Those wouldn't need to be checked. Only when some unknown executable showed up would a remote check be necessary.
When a remote check is necessary, Microsoft on
Translation from BusinessSpeak (Score:2)
"We don't use this data to identify, contact or target advertising to our users and we don't share it with third parties."
There are certain grammatical rules in BusinessSpeak which should be kept in mind. For example, in proper BusinessSpeak, the phrase "At this time" which goes before "we" in the preceding quotation is silent.
Re: (Score:2)